EP0543698A1 - Device for employment of fault information in a single/multi-computer aircraft system - Google Patents

Abstract

Device for making use of information relating to the breakdowns detected by a central processing unit (2) of an aircraft which is linked via an address and data bus (4) to a first memory (6) storing this information, including a second non-volatile, removable memory (7) which can be connected to the said bus (4) and into which the information contained in the first memory (6) can be recopied so as to process it in a calculating centre. - Application to the maintenance of aircraft computers. <IMAGE>

Description

The present invention relates to a device allowing the exploitation of the faults detected and stored by the central unit of one or more computers of an aircraft.

During the flight of an aircraft, each of its computers monitors its own operation, and possibly that of the others, so as to quickly detect any failure and contain its effects, and in particular avoid sending incorrect orders. Similarly, the various components of the aircraft are monitored so as to quickly detect any anomaly, be able to report it, and possibly try to remedy it. The context of a failure is memorized, if the computer is still able to do so, so that a subsequent fine analysis makes it possible to locate the faulty element or to find a software fault specific to the context. In order to make the system more reliable and to remove any ambiguities that may arise from failures due to the computer and not to the aircraft components, at least two computers are implemented which perform the same function.

During ground maintenance operations, fault information, stored at the level of each computer in a non-volatile memory, is displayed so as to analyze the context and determine the element of this computer or the body that created the failure, as well as the probable reason for this failure. This processing of the information can be carried out using a centralized scanning system integrated into the aircraft, which, by means of a menu, allows the maintenance technician to successively view the content of memory areas relating to the various faults detected. This method is however quite slow, because it is necessary to successively choose, by means of the menu, all of the memory areas of a computer, which may require 20 minutes, then examine the following computer. In addition, the presentation of information is quite poor because the output interface of the computer concerned is an interface with very basic communication protocol that can only control a fairly rudimentary printer, with thermal printing for example, with a number of columns limited to 16 for example. The same must be done for the other calculators, and we end up with long lengths of paper rolls, not very easy to handle, and on which the same information is not always in the same order if the various pages of the menu are not not called in the same sequence. In addition, the output of the information being done only visually, on paper or possibly on screen, this prohibits any exploitation other than manual which would use a maintenance computer capable of automatically processing the data from the various computers.

We can obviously think of transferring the data arriving at the printer to a maintenance computer located in a data center, but such a transfer, several hundred meters away, would require the addition of interfaces adapted to the transfer at such a distance. and powered by the power supply to the aircraft computers, which would increase its size and weight.

Similarly, you can also remove the computers and run them on a test bench to test their various modules, but this change of place modifies the operating conditions of the computer, such as the temperature, and can hide failures that appear only in marginal environmental conditions.

The present invention aims to avoid these drawbacks.

• une deuxième mémoire non volatile, amovible, connectable audit bus ;
• des moyens de test de présence pour détecter la présence éventuelle de ladite deuxième mémoire ;
• des moyens de libération, aptes à libérer, pour d'autres tâches, l'unité centrale ;
• des premiers moyens d'adressage en lecture et des premiers moyens de mémorisation, respectivement aptes à lire, à des adresses prédéterminées, et à mémoriser :
  • . la valeur de la première adresse de ladite première mémoire,
  • . la valeur de la première adresse de ladite deuxième mémoire,
  • . le nombre d'adresses de la première mémoire dont le contenu est à transférer vers la deuxième mémoire ;
• des deuxièmes moyens d'adressage en lecture de la première mémoire et des seconds moyens de mémorisation temporaire du contenu correspondant ;
• des moyens d'adressage en écriture de la deuxième mémoire ;
• des moyens d'incrémentation, aptes à ajouter un incrément aux adresses de la première et de la deuxième mémoire ;
• des moyens comparateurs, aptes à déterminer si le cumul desdits incréments est égal à un nombre prédéterminé, et, si oui, à commander lesdits moyens de libération ;
• des moyens de branchement, commandés par lesdits moyens comparateurs, aptes, en cas d'inégalité détectée par ces derniers, à modifier l'adresse de programme à exécuter.

To this end, according to the invention, the device for processing information relating to faults detected by a central unit of an aircraft which is connected by an address and data bus to a first memory storing this information, is remarkable. in that it includes:

• a second, non-volatile, removable memory, connectable to said bus;
• presence test means for detecting the presence optional said second memory;
• release means, able to release, for other tasks, the central unit;
• first reading addressing means and first storage means, respectively capable of reading, at predetermined addresses, and of storing:
  • . the value of the first address of said first memory,
  • . the value of the first address of said second memory,
  • . the number of addresses of the first memory whose content is to be transferred to the second memory;
• second reading addressing means of the first memory and second temporary storage means of the corresponding content;
• means for addressing in writing the second memory;
• incrementing means, capable of adding an increment to the addresses of the first and of the second memory;
• comparator means, capable of determining whether the accumulation of said increments is equal to a predetermined number, and, if so, controlling said release means;
• connection means, controlled by said comparator means, capable, in the event of an inequality detected by the latter, in modifying the address of the program to be executed.

It is thus possible, when the second memory is present, to copy therein the information relating to the breakdowns and contained in the first memory which, preferably, is also non-volatile. The fact that this second memory is removable makes it possible to transport it and have it read by a maintenance computer which can then print it on a parallel printer, which offers a presentation of the usual "listing" more compact than that of a narrow roll of paper. In addition, this maintenance computer can perform data analysis.

Said second memory can be connected to the central unit by an integrated circuit support. This second memory can thus be easily removed, without the need to add a lot of material to do this.

Alternatively, said second memory can be installed on a removable module, which avoids damaging the connections specific to the integrated circuit constituting this second memory.

Advantageously, said removable module is carried by the central unit module, which increases the compactness of the assembly.

In addition, it is practical for said removable module to include connection means allowing the removal of this removable module without disconnecting the module from the central unit of the bottom of the cage bus, which avoids the computer stopping.

Likewise, said removable module can be implantable at the location of a centralized scanning module of said first memory, which avoids having to provide an additional connector location.

Preferably, a device for using information relating to faults is used, comprising several central units per aircraft memorizing said faults in first memories respectively connected to the corresponding central unit by an address and data bus, remarkable in that that it includes several devices as described above.

This provides information that can be redundant, exploited either visually or by the maintenance computer.

The figures of the appended drawing will make it clear how the invention can be implemented. In these figures, identical references represent identical or similar elements.

FIG. 1 represents the central unit of a computer of the aircraft, to which a module carrying a second memory is connected.

FIG. 2 is a flowchart illustrating the transfer of information from a first memory of this central unit to the second memory.

FIG. 3 is a block diagram illustrating various elements making it possible to produce said flow chart.

The module 1 carrying the central unit 2 of an aircraft computer is represented in FIG. 1. This central unit 2 comprises a microprocessor 3, for example of the type 80186, produced by the company of the United States of America INTEL , connected to a local address and data bus 4. An address decoder 5 receives the most significant bits from the address part of the bus 4 and supplies on output wires, specifically to each of the integrated circuits indicated below, selection signals CSk, with k integer of specific value at each such signal. These output wires carrying the selection signals CSk are part of the bus 4, and one can be, at a given instant, in an active state and thus capable of validating the address of the integrated circuit receiving this selection signal CSk active . A first memory 6 of EEPROM type (electrically erasable read-only memory), for example of commercial reference 2864 and of capacity 8 k bytes, is connected to bus 4, while a second memory 7 of EEPROM type, identical to the first memory 6 and connected to the bus 4, is installed on a removable module 8 constituted by a daughter card, carried by the module 1 which acts as a mother card, and is connected to the latter by a connector 9. This card daughter 8 is located on the front face of the motherboard 1 so that it can be connected or disconnected without the need to remove the motherboard 1 from its location. A third memory 10, of EPROM type (erasable read-only memory), for example of commercial reference 2764, located on the motherboard 1 and connected to the bus 4, includes the resident software, allowing the computer to be initialized during the power up and including the various operating software. A fourth memory 11, of EPROM type, which may be identical to the third memory 10, connected to the bus 4 and installed on the daughter card 8, is a read-only memory comprising the functional software allowing read access to the first memory 6 and write access to the second memory 7. The motherboard 1 is connected by a connector 12, placed at the rear of this motherboard 1, to a cage bottom bus 13, common to several modules, these the latter may, for example, be couplers retrieving state data from various components of the aircraft or from elements of other computers.

It will be apparent to a person skilled in the art that each memory can be constituted by several memory circuits, so as to achieve the number of addresses and the word format desired. Similarly, four memories have been described, from two different technologies, but it is also possible to group the functions of the first memory 6 and of the third memory 10 into a single memory capable of retaining information in the event of a power outage. the power supply, for example an EEPROM memory. It is the same for the second memory 7 and fourth memory 11. Other technologies, such as magnetic bubble memories can also be used, when a large memory capacity is necessary.

The operation of this module 1 is as follows. During the course of the various operating programs contained in the third memory 10, the microprocessor 3 verifies the absence of an operating fault, by known means such as redundant codes, timers, or the like. In the event of a fault, this microprocessor 3 then writes, in the first memory 6, the context, that is to say the configuration of the various hardware and software elements involved. It can even be used to perform a disturbance recorder function, by memorizing the history before the fault, this being achieved by systematically memorizing the successive contexts and erasing them cyclically if no fault has occurred. The contexts of the various faults, permanent or transient, which appeared during the operation of the computer, are thus stored in memory areas of successive addresses. In order to avoid subsequently copying unwritten memory areas, a pointer can be provided indicating the number of addresses where a write has been made. The value T of this pointer can be written, for example, to the first address of this first memory 6.

To copy the contents of the first memory 6 in the second memory 7, the corresponding program is carried out, which is contained in the fourth memory 11. The triggering order of this feedback program can be transmitted explicitly to the microprocessor 3 by any means, such as push button, or be implicitly transmitted, by switching on the computer for example.

The progress of this copying program is described by the flowchart represented in FIG. 2 and for which FIG. 3 explains some of the elements used by the microprocessor 3. In this FIG. 3, the information path is shown diagrammatically by lines specific to each of the elements, this for the sake of clarity, but it must be understood that the connections between the microprocessor 3 and the various memories physically use the bus 4, which is symbolized by V or Ad depending on whether the specific line considered represents the value part or address of this bus 4. As indicated previously, the fourth memory 11 contains the feedback program and is cyclically read by the microprocessor 3 through the bus 4. The sequencer of the microprocessor 3 is identified 3s. The elements referenced 20 to 29 described below comprise hardware components which can be included in the microprocessor 3.

In this flow diagram of FIG. 2, the diamonds indicate a test operation, the positive or negative result of which is indicated respectively by the letter O or N. The successive stages are indicated by a letter outside the framework relating to this stage, while the reference of the element considered is indicated in parentheses.

• a- après avoir reçu l'ordre REC, explicite ou implicite, d'effectuer la recopie du contenu de la première mémoire 6 dans la deuxième mémoire 7, le microprocesseur 3 utilise des moyens de test de présence 20 pour savoir si la quatrième mémoire 11 associée à cette deuxième mémoire 7 est présente dans le calculateur. Ce test peut être effectué en émettant, sur la partie adresse du bus 4, une adresse prédéterminée, dont la valeur est préalablement lue dans la quatrième mémoire 11, puis en lisant la valeur en retour sur la partie valeur de ce bus 4. Si la quatrième mémoire 11 associée à la deuxième mémoire 7 est présente, elle répond en émettant une valeur prédéterminée et connue par le microprocesseur 3 par le fait que cette valeur est aussi mémorisée dans la troisième mémoire 10 à une adresse connue du microprocesseur 3. Des moyens aptes à effectuer une comparaison, faisant partie de ces moyens de test de présence 20, fournissent alors au microprocesseur 3 un signal P si la valeur en retour sur la partie valeur du bus 4 est égale à la valeur attendue qui est appliquée sur une autre entrée de ces moyens de test 20 après avoir été préalablement lue dans la troisième mémoire 10, ce qui atteste alors la présence de la deuxième mémoire 7 ;
• b- en cas d'absence de cette deuxième mémoire 7, le microprocesseur 3 utilise des moyens internes de libération 21, émettant un signal LIB, afin de libérer l'unité centrale 2 pour d'autres tâches, ces moyens de libération 21 pouvant comporter un additionneur-soustracteur faisant effectuer un saut d'adresse au programme en cours, vers un autre programme, ou comportant un registre contenant une adresse de branchement ;
• c- en cas de présence de cette deuxième mémoire 7, le microprocesseur 3 lit successivement en mémoire, par exemple dans la quatrième mémoire 11, et grâce à des premiers moyens d'adressage en lecture 22, les adresses de début de la première mémoire 6 et de la deuxième mémoire 7, respectivement MAO et MBO, et il lit la valeur T, contenue dans la première mémoire 6, qui indique le nombre de mots ayant des adresses successives à recopier, ces trois valeurs étant provisoirement mémorisées dans des premiers moyens de mémorisation 23 constitués d'un registre interne au microprocesseur 3 ;
• d- le microprocesseur 3 calcule alors la valeur MAO + T au moyen de son bloc de calcul, ce qui correspond à l'adresse suivant l'adresse finale de la zone mémoire à recopier ;
• e- le microprocesseur 3 adresse en lecture, grâce à des deuxièmes moyens d'adressage en lecture 24, l'adressé MAi, égale à MAO lors de la première lecture, de la première mémoire 6 et mémorise, dans des seconds moyens de mémorisation 25, constitués d'un registre tampon interne, la valeur Vi lue en retour sur la partie valeur du bus 4 ;
• f- le microprocesseur 3 adresse en lecture les seconds moyens de mémorisation 25 et adresse en écriture, grâce à des moyens d'adressage en écriture 26, l'adresse MBi de la deuxième mémoire 7, égale à MBO lors de la première écriture, et y écrit la valeur Vi qui a été mémorisée à l'étape précédente dans les seconds moyens de mémorisation 25 ;
• g- le microprocesseur 3 ajoute un incrément d'une unité à l'adresse MAi, ceci en utilisant des moyens d'incrémentation 27 constitués d'un additionneur fournissant en retour la valeur MAi + 1 ;
• h- le microprocesseur 3 ajoute, avec les mêmes moyens d'incrémentation 27, un incrément d'une unité à l'adresse MBi ;
• i- le microprocesseur 3 recherche si le cumul des incréments est égal à T. De façon pratique, il recherche si l'égalité MAi = MAO + T est vérifiée, ceci grâce à des moyens comparateurs 28 de tout type connu, ou un soustracteur qui fournit une sortie nulle en cas d'égalité ;
• j- si l'égalité à l'étape ci-dessus est vérifiée, le microprocesseur 3 émet un signal ST mettant fin aux opérations de recopie, et commande l'allumage d'un voyant (non représenté) indiquant la fin de cette recopie ;
• k- le microprocesseur 3 se libère alors pour d'autres tâches, grâce auxdits moyens de libération 21 ;
• l- si l'égalité ci-dessus n'est pas vérifiée, le microprocesseur 3 revient à l'étape e grâce à des moyens de branchement 29, commandés par lesdits moyens comparateurs 28, aptes, en cas d'inégalité détectée par ces derniers, à modifier l'adresse de programme en cours. Ces moyens de branchement 29 comportent un additionneur-soustracteur apte à modifier l'adresse du programme en cours d'exécution de façon à effectuer un branchement à l'adresse relative au début de l'étape e , ou bien comportent un registre contenant une adresse spécifique Adx.

The organization chart includes the following successive steps:

• a- after having received the REC command, explicit or implicit, to carry out the copying of the content of the first memory 6 into the second memory 7, the microprocessor 3 uses presence test means 20 to know whether the fourth memory 11 associated with this second memory 7 is present in the computer. This test can be carried out by transmitting, on the address part of the bus 4, a predetermined address, the value of which is previously read in the fourth memory 11, then by reading the value back on the value part of this bus 4. If the fourth memory 11 associated with the second memory 7 is present, it responds by emitting a predetermined value known by the microprocessor 3 by the fact that this value is also stored in the third memory 10 at an address known to the microprocessor 3. Means capable of making a comparison, forming part of these presence test means 20, then supply the microprocessor 3 a signal P if the value returns on the value part of the bus 4 is equal to the expected value which is applied to another input of these test means 20 after having been previously read in the third memory 10, which then attests to the presence of the second memory 7;
• b- in the absence of this second memory 7, the microprocessor 3 uses internal release means 21, emitting a LIB signal, in order to release the central unit 2 for other tasks, these release means 21 possibly comprising an adder-subtractor causing an address jump to the current program, to another program, or comprising a register containing a connection address;
• c- in the presence of this second memory 7, the microprocessor 3 successively reads from memory, for example from the fourth memory 11, and by virtue of first read addressing means 22, the start addresses of the first memory 6 and from the second memory 7, MAO and MBO respectively, and it reads the value T , contained in the first memory 6, which indicates the number of words having successive addresses to be copied, these three values being temporarily stored in first means of storage 23 consisting of a register internal to the microprocessor 3;
• d- the microprocessor 3 then calculates the value MAO + T by means of its calculation block, which corresponds to the address according to the final address of the memory area to be copied;
• e- the microprocessor 3 read address, by means of second read addressing means 24, the address MAi, equal to MAO during the first reading, of the first memory 6 and stores, in second storage means 25, consisting of an internal buffer register, the value Vi read back on the value part of the bus 4;
• f- the microprocessor 3 addresses in reading the second storage means 25 and writing address, by means of writing addressing means 26, the address MBi of the second memory 7, equal to MBO during the first writing, and writes there the value Vi which was stored in the previous step in the second storage means 25;
• g- the microprocessor 3 adds an increment of one unit to the address MAi, this using incrementing means 27 consisting of an adder providing in return the value MAi + 1;
• h- the microprocessor 3 adds, with the same incrementing means 27, an increment of one unit to the address MBi;
• i- the microprocessor 3 searches if the cumulative increments is equal to T. In practical terms, it searches whether the equality MAi = MAO + T is verified, this using comparator means 28 of any known type, or a subtractor which provides zero output in the event of equality;
• j- if the equality in the above step is verified, the microprocessor 3 emits a signal ST putting an end to the copying operations, and controls the lighting of an indicator (not shown) indicating the end of this copying;
• k- the microprocessor 3 is released for other tasks, thanks to said release means 21;
• l- if the above equality is not verified, the microprocessor 3 returns to step e thanks to connection means 29, controlled by said comparator means 28, capable, in the event of an inequality detected by the latter , to modify the current program address. These connection means 29 comprise an adder-subtractor capable of modifying the address of the program being executed so as to make a connection to the address relating to the start of step e , or else comprise a register containing an address specific Adx.

In the case where one wishes to be able to quickly read some of the information contained in the first memory 6, for example when the desired information is of limited size, the third memory 10 then contains software capable of managing a scanning function making it possible to read the information contained in the first memory 6 and to communicate it, through the cage bottom bus 13 of the computer, to a coupler module controlling a printer or a screen. In the general case, to ensure redundancy ,. there are several computers installed as described above, and this scanning function is centralized and controlled by a man-machine relationship interface, which allows you to choose to display the data relating to the desired computer. To facilitate this choice, a menu is available on the human-machine dialogue interface, printer or screen.

It should be noted that the copying function described above can be carried by a specific daughter card 8, the scanning function being located on another daughter card 8 which can replace the previous one, or, on the contrary, the daughter card 8 can have memories of sufficient capacity to be able to process the two functions. In either case, the presence of the feedback function can be detected by the microprocessor 3 by a reading at a predetermined address, which will return said predetermined value only if the corresponding software is installed.

For ease of handling, the second removable memory 7 has been described as being carried by a daughter card 8 connected to the mother card 1 by a connector 9. It is obviously possible to delete the daughter card 8 and to install the components thereof directly on the mapmaker 1, the second memory 7 being connected by means of an integrated circuit support, which retains the removability of this second memory 7. However, the connection pins of an integrated circuit, being small, are fragile and they could be damaged during connections and successive disconnections, which would decrease reliability. Likewise, the function provided by the daughter card 8 can also be carried by a module connected directly to the bottom of the cage bus 13.

The second memories 7 of the various computers can thus receive a copy of the information relating to faults and contained in the first associated memories 6. In an exemplary embodiment, this copying takes place in approximately 3 minutes, regardless of the number of computers, instead of approximately 20 minutes per computer when the information is output on a thermal printer using centralized scanning with menu . These second memories 7 are then transported to a maintenance computer, having powerful display means, such as a 144 column parallel printer or an 80 column screen, which provide the information in compact form. This maintenance computer can also be programmed to perform an analysis of the information contained in these second memories 7, for example to identify a faulty element by means of an expert system type program. Similarly, it can compare the information provided by the various computers, which facilitates diagnosis.

Claims (7)

Device for processing information relating to faults detected by a central unit (2) of an aircraft which is connected by an address and data bus (4) to a first memory (6) memorizing this information, characterized in that that it includes: - a second, non-volatile, removable memory (7), connectable to said bus (4); - presence test means (20) for detecting the possible presence of said second memory (7); - release means (21), able to release, for other tasks, the central unit (2); - first reading addressing means (22) and first storage means (23), respectively capable of reading, at predetermined addresses, and of storing: . the value (MAO) of the first address of said first memory (6), . the value (MBO) of the first address of said second memory (7), . the number of addresses (T) of the first memory (6) whose content is to be transferred to the second memory (7); - second reading addressing means (24) of the first memory (6) and second temporary storage means (25) of the corresponding content; - write addressing means (26) of the second memory (7); - incrementing means (27), capable of adding an increment to the addresses (MAi, MBi) of the first memory (6) and of the second memory (7); - Comparator means (28), capable of determining whether the accumulation of said increments is equal to a predetermined number, and, if so, controlling said release means (21); - connection means (29), controlled by said comparator means (28), able, in the event of an inequality detected by the latter (28), to modify the address of the program to be executed. Device according to claim 1, characterized in that said second memory (7) is connected to the central unit (2) by an integrated circuit support. Device according to claim 1, characterized in that said second memory (7) is located on a removable module (8). Device according to claim 3, characterized in that said removable module (8) is carried by the module (1) of the central unit (2). Device according to claim 4, characterized in that said removable module (8) comprises connection means (9) allowing the removal of this removable module (8) without disconnecting the module (1) from the central unit (2) of the cage bottom bus (13). Device according to any one of claims 3 to 5, characterized in that said removable module (8) can be installed at the location of a centralized scanning module of said first memory (6). Device for processing information relating to faults, comprising several central units (2) per aircraft memorizing said faults in first memories (6) respectively connected to the corresponding central unit (2) by a bus (4) with address and data, characterized in that it comprises several devices according to any one of claims 1 to 6.

Images